Air France 447

"To put it briefly, automation has made it more and more unlikely that ordinary airline pilots will ever have to face a raw crisis in flight—but also more and more unlikely that they will be able to cope with such a crisis if one arises."

— William Langewiesche

• On Sunday 31 May 2009, the Airbus A330-203 registered F-GZCP operated by Air France was programmed to perform scheduled flight AF 447 between Rio de Janeiro Galeão and Paris Charles de Gaulle. Twelve crew members (3 flight crew, 9 cabin crew) and 216 passengers were on board. The departure was planned for 22 h 00.
• At around 22 h 10, the crew was cleared to start up engines and leave the stand. Takeoff took place at 22 h 29. The Captain was Pilot Not Flying (PNF); one of the copilots was Pilot Flying (PF).
• At the start of the Cockpit Voice Recorder (CVR) recording, shortly after midnight, the aeroplane was in cruise at flight level 350. Autopilot 2 and auto-thrust were engaged. Auto fuel transfer in the “trim tank” was carried out during the climb. The flight was calm.
• At 1 h 35, the aeroplane arrived at INTOL point and the crew left the Recife frequency to change to HF communication with the Atlántico Oceanic control centre. A SELCAL test was successfully carried out, but attempts to establish an ADS-C connection with DAKAR Oceanic failed.
• Shortly afterwards, the co-pilot modified the scale on his Navigation Display (ND) from 320 NM to 160 NM and noted “. . . a thing straight ahead”. The Captain confirmed and the crew again discussed the fact that the high temperature meant that they could not climb to flight level 370.
• At 1 h 45, the aeroplane entered a slightly turbulent zone, just before SALPU point. Note: At about 0 h 30 the crew had received information from the OCC about the presence of a convective zone linked to the inter-tropical convergence zone (ITCZ) between SALPU and TASIL.
• The crew dimmed the lighting in the cockpit and switched on the lights “to see”. The co-pilot noted that they were “entering the cloud layer” and that it would have been good to be able to climb. A few minutes later, the turbulence increased slightly in strength.
• Shortly after 1 h 52, the turbulence stopped. The co-pilot again drew the Captain’s attention to the REC MAX value, which had then reached flight level (FL) 375. A short time later, the Captain woke the second co-pilot and said “[…] he’s going to take my place”.
• At around 2 h 00, after leaving his seat, the Captain attended the briefing between the two co-pilots, during which the PF (seated on the right) said specifically that “well the little bit of turbulence that you just saw we should find the same ahead we’re in the cloud layer unfortunately we can’t climb much for the moment because the temperature is falling more slowly than forecast” and that “the logon with DAKAR failed”. Then the Captain left the cockpit.
• The aeroplane approached the ORARO point. It was flying at flight level 350 and at Mach 0.82. The pitch attitude was about 2.5 degrees. The weight and balance of the aeroplane were around 205 tonnes and 29%.
• The two copilots again discussed the temperature and the REC MAX. The turbulence increased slightly. At 2 h 06, the PF called the cabin crew, telling them that “in two minutes we ought to be in an area where it will start moving about a bit more than now you’ll have to watch out there” and he added “I’ll call you when we’re out of it”.
• At around 2 h 08, the PNF proposed “go to the left a bit [. . . ]”. The HDG mode was activated and the selected heading decreased by about 12 degrees in relation to the route. The PNF changed the gain adjustment on his weather radar to maximum, after noticing that it was in calibrated mode. The crew decided to reduce the speed to about Mach 0.8 and engine de-icing was turned on.
• At 2 h 10 min 05, the autopilot then the auto-thrust disconnected and the PF said “I have the controls”. The aeroplane began to roll to the right and the PF made a nose-up and left input. The stall warning triggered briefly twice in a row. The recorded parameters showed a sharp fall from about 275 kt to 60 kt in the speed displayed on the left primary flight display (PFD), then a few moments later in the speed displayed on the integrated standby instrument system (ISIS). The flight control law reconfigured from normal to alternate. The Flight Directors (FD) were not disconnected by the crew, but the crossbars disappeared.
• Note: Only the speeds displayed on the left side and on the ISIS are recorded on the FDR; the speed displayed on the right side is not recorded.
• At 2 h 10 min 16, the PNF said “we’ve lost the speeds” then “alternate law protections”. The PF made rapid and high amplitude roll control inputs, more or less from stop to stop. He also made a nose-up input that increased the aeroplane’s pitch attitude up to 11° in ten seconds.
• Between 2 h 10 min 18 and 2 h 10 min 25, the PNF read out the ECAM messages in a disorganized manner. He mentioned the loss of autothrust and the reconfiguration to alternate law. The thrust lock function was de-activated. The PNF called out and turned on the wing anti-icing.
• The PNF said that the aeroplane was climbing and asked the PF several times to descend. The latter then made several nose-down inputs that resulted in a reduction in the pitch attitude and the vertical speed. The aeroplane was then at about 37,000 ft and continued to climb.
• At about 2 h 10 min 36, the speed displayed on the left side became valid again and was then 223 kt; the ISIS speed was still erroneous. The aeroplane had lost about 50 kt since the autopilot disconnection and the beginning of the climb. The speed displayed on the left side was incorrect for 29 seconds.
• At 2 h 10 min 47, the thrust controls were pulled back slightly to 2/3 of the IDLE/CLB notch (85% of N1). Two seconds later, the pitch attitude came back to a little above 6°, the roll was controlled and the angle of attack was slightly less than 5°.

Source: BEA Report, ¶1.1

• The aeroplane’s pitch attitude increased progressively beyond 10 degrees and the plane started to climb.
• From 2 h 10 min 50, the PNF called the Captain several times.
• At 2 h 10 min 51, the stall warning triggered again, in a continuous manner. The thrust levers were positioned in the TO/GA detent and the PF made nose-up inputs. The recorded angle of attack, of around 6 degrees at the triggering of the stall warning, continued to increase. The trimmable horizontal stabilizer (THS) began a nose-up movement and moved from 3 to 13 degrees pitch-up in about 1 minute and remained in the latter position until the end of the flight. Around fifteen seconds later, the ADR3 being selected on the right side PFD, the speed on the PF side became valid again at the same time as that displayed on the ISIS. It was then at 185kt and the three displayed airspeeds were consistent. The PF continued to make nose-up inputs. The aeroplane’s altitude reached its maximum of about 38,000 ft; its pitch attitude and angle of attack were 16 degrees.
• At 2 h 11 min 37, the PNF said “controls to the left”, took over priority without any callout and continued to handle the aeroplane. The PF almost immediately took back priority without any callout and continued piloting.

Source: BEA Report, ¶1.1

• At around 2 h 11 min 42, the Captain re-entered the cockpit. During the following seconds, all of the recorded speeds became invalid and the stall warning stopped, after having sounded continuously for 54 seconds. The altitude was then about 35,000 ft, the angle of attack exceeded 40 degrees and the vertical speed was about -10,000 ft/min. The aeroplane’s pitch attitude did not exceed 15 degrees and the engines’ N1’s were close to 100%. The aeroplane was subject to roll oscillations to the right that sometimes reached 40 degrees. The PF made an input on the side-stick to the left stop and nose-up, which lasted about 30 seconds.
• At 2 h 12 min 02, the PF said, “I have no more displays”, and the PNF “we have no valid indications”. At that moment, the thrust levers were in the IDLE detent and the engines’ N1’s were at 55%. Around fifteen seconds later, the PF made pitch-down inputs. In the following moments, the angle of attack decreased, the speeds became valid again and the stall warning triggered again.
• At 2 h 13 min 32, the PF said, “[we’re going to arrive] at level one hundred”. About fifteen seconds later, simultaneous inputs by both pilots on the side-sticks were recorded and the PF said, “go ahead you have the controls”.
• The angle of attack, when it was valid, always remained above 35 degrees.
• From 2 h 14 min 17, the Ground Proximity Warning System (GPWS) “sink rate” and then “pull up” warnings sounded.
• The recordings stopped at 2 h 14 min 28. The last recorded values were a vertical speed of -10,912 ft/min, a ground speed of 107 kt, pitch attitude of 16.2 degrees nose-up, roll angle of 5.3 degrees left and a magnetic heading of 270 degrees.
• No emergency message was transmitted by the crew. The wreckage was found at a depth of 3,900 metres on 2 April 2011 at about 6.5 NM on the radial 019 from the last position transmitted by the aeroplane.

Source: BEA Report, ¶1.1

The captain was 58 years old with about 11,000 hours total time, over 6,000 hours as captain, and 1,747 in type, all as captain. He started with Air France as a flight attendant, earned several ratings as a non-airline pilot, mostly in light aircraft. He was hired by Air Inter airline in a Caravelle and then A300. He became PIC qualified for the first time in 1997, two days before Air France and Air Inter merged. A year later he became a captain with Air France on the Boeing 737-200. Three years later be became A320 rated. Three years after that he added an A330 rating, a year after that he failed a line training flight test. (This is his first failure noted in the accident report.) . He added at A340 rating in 2007

Source: Extracted from BEA Report, ¶1.5

The crew arrived in Rio three days before the accident and stayed at the Sofitel hotel on Copacabana Beach. At Air France, the layover there was considered to be especially desirable. [The] captain, Marc Dubois, 58, was traveling with an off-duty flight attendant and opera singer. In the French manner, the accident report made no mention of Dubois’s private life, but that omission then required a finding that fatigue played no role, when the captain’s inattention clearly did. Dubois had come up the hard way, flying many kinds of airplanes before hiring on with Air Inter, a domestic airline subsequently absorbed by Air France; he was a veteran pilot, with nearly 11,000 flight hours, more than half of them as captain. But, it became known, he had gotten only one hour of sleep the previous night. Rather than resting, he had spent the day touring Rio with his companion.

Source: Langewiesche

The copilot in the left seat was 37 years old with around 7,000 hours total time, almost 5,000 of that in type. He appears to have been an "ab initio" trainee hired directly by Air France just six years after earning his base license. He went directly into the A320 with Air France and later added at A340 and then the A330 type ratings.

Source: Extracted from BEA Report, ¶1.5

The copilot in the right seat was 32 years old with about 3,000 hours total time, 800 in type. Three years after earning his private pilot's license, Air France hired him and a year later he was flying the A320. Three years later he added the A340 and then the A330 ratings.

Source: Extracted from BEA Report, ¶1.5

Occupying the right seat was the junior co-pilot, Pierre-Cédric Bonin, 32, who had brought along his wife for the trip, leaving their two young sons at home. [ . . . ] Bonin, whose turn it was to be the Pilot Flying—making the takeoff and landing, and managing the automation in cruising flight. Bonin was a type known as a Company Baby: he had been trained nearly from scratch by Air France and placed directly into Airbuses at a time when he had only a few hundred flight hours under his belt. By now he had accumulated 2,936 hours, but they were of low quality, and his experience was minimal, because almost all of his flight time was in fly-by-wire Airbuses running on autopilot.

Source: Langewiesche

A Flight Safety report was made in 2006 by an airline internal commission following incidents and accidents, in particular the Air France accident at Toronto in August 2005. The commission studied events at the airline that had occurred between 1985 and 2006. Notable elements from the report identified:

• During the period in question, two-thirds of the events occurred on long-haul flights;
• The “situational awareness”, “decision-making” and “crew synergy” causal factors were inseparable and constituted by far the most significant contributing factor;
• Piloting abilities of long-haul and/or ab initio pilots are sometimes weak;
• A loss of common sense and general aeronautical knowledge were highly noticeable;
• Weaknesses in terms of representation and awareness of the situation during system failures (reality, seriousness, induced effects).

Source: BEA Report, ¶1.17.1.5.4

Information on the airspeed measuring system

• The speed is deduced from the measurement of two pressures:
• Total pressure (Pt), by means of an instrument called a Pitot probe;
• Static pressure (Ps), by means of a static pressure sensor.
• The Airbus A330 has three Pitot probes and six static pressure sensors.
• These probes are fitted with drains allowing the removal of water, and with an electrical heating system designed to prevent them from icing up.
• The pneumatic measurements are converted into electrical signals by eight ADM’s and delivered to the calculators in that form.
• The CAS and Mach number are the main items of speed information used by the pilots and the systems to control the aeroplane. These parameters are elaborated by three computers, called ADIRU, each consisting of:
• An ADR module which calculates the aerodynamic parameters, specifically the CAS and the Mach;
• An IR module that provides the parameters delivered by the inertial units, such as ground speed and attitudes.
• There are therefore three speed information elaboration systems that function independently of each other. The probes known as “Captain” supply ADR 1, the “First Officer” probes supply ADR 2 and the “Standby” probes supply ADR 3.
• The standby instruments elaborate their speed and altitude information directly from the pneumatic inputs (“standby” probes), without this being processed by an ADM or ADR. The ISIS is a unique standby instrument integrating speed, altitude and attitude information. It uses the same static and total pressure sensors as ADR3.
• The autopilot, flight director and autothrust functions are ensured by two Flight Management Guidance and Envelope Computers (FMGEC), connected in particular to a Flight Control Unit (FCU). Each of these two computers can perform these three functions.
• In order to operate, and determine the FD’s cues, the FMGEC need to use the data from at least two ADR’s and two IR’s, which they must consider to be valid. The monitoring performed by the FMGEC on the ADR and IR parameters looks for deviations with respect to two other values. For example, if one of the parameters from an ADR deviates excessively from the values indicated for the same parameter by the two other ADR’s, then the first shall be considered as invalid and will not be used. If at least two ADR’s or two IR’s are invalid, the FMGEC can no longer determine the FD’s cues and the crossbars disappear. However, the FD’s are not disengaged; the corresponding lights on the FCU remain lit.

Source: BEA Report, ¶1.6.6

• When highly specific climatic conditions are met, in particular with the presence of ice crystals in excessive quantities, the conditions for use of the probes can exceed the conditions for qualification and robustness. In this type of situation, a partial obstruction of the total pressure probes in icing conditions and at high altitude (above 30,000 feet) can occur. This results in a temporary and reversible deterioration of total pressure measurement.
• In the presence of ice crystals, there is no visible accretion of ice or frost on the outside, nor on the nose of the probe, since the crystals bounce off of these surfaces. However, the ice crystals can be ingested by the probe air intake. According to the flight conditions (altitude, temperature, Mach) if the concentration of crystals is greater than the capacity for de-icing of the heating element and evacuation by the purge holes, the crystals accumulate in large numbers in the probe tube.
• As a result, a physical barrier is created inside the probe that will disturb the measurement of total pressure, this then being able to approach that of the measured static pressure.
• As soon as the concentration of ice crystals is lower than the de-icing capacity of the probe, the physical barrier created by the accumulation of crystals disappears and measurement of the total pressure becomes correct again.
• Experience and follow-up of these phenomena in very severe conditions show that this loss of function is of limited duration, in general around 1 or 2 minutes.

Source: BEA Report, ¶1.6.9.6

• From 2 h 10 min 05 onwards, the flight control law was alternate and the stall warning triggered and stopped several times until the end of the flight. Only the values for one Mach calculation were recorded, although the warning triggering threshold depends on all three.
• The activations of the warning picked up by the CVR were identified as occurring at between 2 h 10 min 10.4 and 11.3 and between 2 h 10 min 13 and 13.4. The short duration of activation did not make it possible to detect it from the “Stall warning” parameter, but the FWC 1’s “Master warning” parameters were triggered on one point at this time. However, this warning should have continued until about 2 h 10 min 15.5, and then have been triggered again between 2 h 10 min 17 and 19. The disabling of this warning was probably due to the fact that, between 13.4 and 15.5 and then between 17 and 19, and possibly at other times, the three Mach values were abnormally low (three Pitot probes iced up). The warning triggering threshold then suddenly increased to values of about 10°, much greater than the recorded angles of attack, which led to the warning stopping.
• Analysis of the parameters showed that the stall warning stopped concomitant with the invalidity of the three angles of attack, and was triggered again when at least one of them became valid again. In view of the extreme values of angle of attack experienced by the aircraft, the change to the threshold as a function of Mach was secondary.

Source: BEA Report, ¶1.16.3.2

• A simulation of the aircraft behaviour was conducted based on the theoretical model and on the PF’s inputs (sidestick and thrust). The validity of the model is limited to the known flight envelope based on flight tests. Consequently, it was possible to conduct the simulation on the period from 2 h 10 min 00 s to 2 h 10 min 54 s.
• The simulation demonstrated the following:
• From about 15 seconds before disconnection, the autopilot countered aerological disturbances whose intensity would be defined as “light” on the ICAO scale (variations in vertical acceleration of less than 0.5 g);
• When the autopilot disengaged, a concomitant lateral gust caused the aircraft to depart from its flight path with a roll to the right;
• The subsequent roll movements resulted from the inputs by the PF;
• The aircraft’s movements in the longitudinal axis were primarily due to the inputs by the PF, with the exception of small variations due to the aerology (variations in normal acceleration of about 0.2 g);
• The turbulence eased as from about 2 h 10 min 30 s;
• With no PF inputs, the aircraft would have gradually rolled further to the left but the variations in pitch attitude and altitude would have been small.

Source: BEA Report, ¶1.16.4.1

• When the autopilot disconnected, the roll angle increased in two seconds from 0 to +8.4 degrees without any inputs on the sidesticks. The PF was immediately absorbed by dealing with roll, whose oscillations can be explained by:
• A large initial input on the sidestick under the effect of surprise;
• The continuation of the oscillations, in the time it took to adapt his piloting at high altitude, while subject to an unusual flight law in roll (direct law).
• In addition, the deviation in roll may have been caused by the risk of turbulence that had preoccupied the PF in the minutes leading up the autopilot disconnection.
• Following the autopilot disconnection, the PF very quickly applied nose-up sidestick inputs. The PF’s inputs may be classified as abrupt and excessive. The excessive amplitude of these inputs made them unsuitable and incompatible with the recommended aeroplane handling practices for high altitude flight. This nose-up input may initially have been a response to the perception of the aeroplane’s movements (in particular the reduction in pitch angle of 2° associated with the variation in load factor) just before the AP disconnection in turbulence. This response may have been associated with a desire to regain cruise level: the PF may have detected on his PFD the loss of altitude of about 300 ft and loss of vertical speed of the order of 600 ft/min in descent. The excessive nature of the PF’s inputs can be explained by the startle effect and the emotional shock at the autopilot disconnection, amplified by the lack of practical training for crews in flight at high altitude, together with unusual flight control laws.
• Although the PF’s initial excessive nose-up reaction may thus be fairly easily understood, the same is not true for the persistence of this input, which generated a significant vertical flight path deviation. The safety investigation has made it possible to exclude, with reasonable certainly, the explanation that the repeated nose-up inputs were caused by the PF’s unsuitable flying position (examination of the adjustment of his seat showed that it was adjusted in a way that was adapted to his morphology). Examination of the FDR parameters indicated that during the flight controls check undertaken while taxiing in Rio-de-Janeiro, the roll inputs did not induce a pitch component.
• Whether the PF’s nose-up inputs were deliberate or not, there was no verbal expression of this to the PNF. At no time did the PF indicate his intentions or objectives with respect to the control and stabilisation of the flight path. Although the PF’s various roll inputs indicate his intention to keep the wings horizontal, it is not possible to determine what the PF’s target was in the longitudinal axis.

Source: BEA Report, ¶2.1.2.3

• Once the first actions in response to the perceived anomaly is executed (returning to manual piloting following AP disconnection) and the flight path stabilisation ensured, the philosophy of both the manufacturer and the operator is for the crew to look for additional information necessary to understand the problem and take action.
• Identifying the loss of speed information could have prompted the crew to apply the “IAS douteuse” emergency manoeuvre, if they had considered that the safe conduct of the flight was “dangerously affected”, this condition being generally associated with avoiding a collision with the high ground or terrain. Training for this emergency manoeuvre in a flight phase at low altitude may reinforce this interpretation by crews. In addition, the study of events involving loss of speed indications in cruise tends to show that the emergency manoeuvre is never applied, so much so that the failure to perform this manoeuvre is not specific to the crew of AF 447.
• Neither was the non-ECAM emergency procedure “Vol avec IAS douteuse/ADR Check Proc” called out. A call for this procedure must be sufficiently practised for it to become an automatic response to awareness of an airspeed indication anomaly, regardless of any need to construct a more elaborate understanding of the problem.
• In the case of the accident, the crew did not associate the loss of displayed speeds and the associated procedure.
• The disabling of the THRUST LOCK function by the PF indicates that he was searching for information. The PF may therefore have been overloaded by the combination of his immediate and natural attempts to understand the situation that was added to the already demanding task of handling the aeroplane.

Source: BEA Report, ¶2.1.2.4

• Four seconds before the triggering of the STALL 2 warning, the flight director crossbars reappeared on the PFDs. The vertical mode engaged was V/S mode with a target value of +1,400 ft/min. The modes displayed on the FMA were never called out by the crew. The horizontal bar then indicated a slight nose-up order compared with the aeroplane symbol. The PF’s nose-up input caused the increase in the angle of attack and triggered the stall warning. At the instant when the STALL 2 warning was triggered, at 2 h 10 min 51, the aeroplane’s pitch attitude was 7 degrees, and increasing. A few seconds later, buffet started.
• The crew never referred either to the stall warning or the buffet that they had likely felt. This prompts the question of whether the two co-pilots were aware that the aeroplane was in a stall situation. In fact the situation, with a high workload and multiple visual prompts, corresponds to a threshold in terms of being able to take into account an unusual aural warning. In an aural environment that was already saturated by the C-chord warning, the possibility that the crew did not identify the stall warning cannot be ruled out.
• Even if the PF’s acceptance (or rejection) of a stall diagnosis was never verbalised, even though some of his actions could be considered to be consistent with those recommended in an approach to stall situation: setting the thrust levers to the TOGA detent, or his concern with keeping the wings horizontal. On the other hand, in the absence of airspeed information known to be reliable, it is possible that the PF thought that the aeroplane was in an overspeed situation, notably due to his interpretations of several clues:
• The aerodynamic noise,
• The buffeting, that he might have interpreted as being due to high speed,
• The speed trend arrow on the PFD, which at that time indicated acceleration.
• Some of the PF’s actions may be interpreted as indicative of a perception of a risk or of a diagnosis of overspeed. Firstly, the PF reduced the thrust during the seconds preceding the activation of the STALL 2 warning and the onset of buffet. Secondly, 51 s after the triggering of this warning, the PF said “I have the impression we have speed” then moved the thrust levers to the IDLE detent. He reformulated his impression a few seconds later, combined with an attempt to extend the speedbrakes.
• The application of maximum thrust was probably the consequence of the perception of the stall warning. However, the PF may have assimilated the triggering of the warning as a consequence of the reduction in thrust, which he had applied four seconds earlier; he should then have applied full thrust to return to the earlier situation.
• A few seconds later, the PF said “I’m in TOGA, right?”. Either he was unsure whether or not he had set the thrust controls to the TOGA detent, as he intended, or he did not understand why this action was ineffective in clearing the stall warning. This second case might therefore indicate that the PF had built an erroneous mental representation of the aeroplane’s flight model, and that he had hoped that he could resolve the situation by applying TOGA thrust at high altitude and a pitch attitude of twelve degrees, a strategy similar to that recommended at low altitudes. The fruitless result of his actions possibly heightened his mistrust of the warning.
• Finally, although the PNF had called out the reconfiguration to alternate law when reading the ECAM, and even though the indicators of the loss of protection should have been displayed on the PFD (SPD LIM and an amber cross in roll and yaw), it is possible that the PF was not fully aware of this reconfiguration and of what it implied. He may therefore have embraced the common belief that the aeroplane could not stall, and in this context a stall warning was inconsistent.
• The pitch attitude oscillations, in the seconds following the activation of the stall warning, reveal that the handling of the aeroplane was clearly very difficult and probably demanded the PF’s full attention. During this phase, the aeroplane symbol on the PFD was close to, but on average slightly above, the flight director horizontal bar.
• Moreover, the flight director displays could have prompted him to command a positive pitch angle, of about 12.5°. This value appears in the stall warning procedure for the take-off phase. It is possible that, even though he did not call it out, the PF had recalled this memorised value and then had clung to this reference without remembering that it was intended for a different flight phase. The conjunction of this remembered value and the flight director displays may have constituted one of the few (and maybe even the only) points of consistency in his general incomprehension of the situation.

Note: The “Vol avec IAS douteuse” procedure recommends disabling the FD, to prevent it from presenting cues that could potentially be irrelevant.

• When the Captain returned to the cockpit, the aeroplane was in a rapid descent, though at an altitude close to the cruise level it was at when he had left. Under these conditions, and not having experienced the complete sequence of events, it was very difficult for the Captain to make a diagnosis. He would have needed to question the co-pilots about the sequence of events, an approach that was blocked by the urgency of the situation and the stress conveyed by the PNF’s tone of voice.
• Subsequently, his interventions showed that he had also not identified the stall: the multiple starts and stops of the stall warning certainly contributed to make his analysis of the situation more confused. He then seemed to have based himself on the pitch attitude and thrust parameters to analyse the flight path.

Source: BEA Report, ¶2.1.3.3

• The obstruction of the Pitot probes by ice crystals during cruise was a phenomenon that was known but misunderstood by the aviation community at the time of the accident.
• The occurrence of the failure in the context of flight in cruise completely surprised the pilots of flight AF 447. The apparent difficulties with aeroplane handling at high altitude in turbulence led to excessive handling inputs in roll and a sharp nose-up input by the PF.
• The crew, progressively becoming de-structured, likely never understood that it was faced with a “simple” loss of three sources of airspeed information.
• The aeroplane went into a sustained stall, signalled by the stall warning and strong buffet. Despite these persistent symptoms, the crew never understood that they were stalling and consequently never applied a recovery manoeuvre.

Source: BEA Report, ¶3.2